### filter rules
block all
block drop in quick on $ext_if from $priv_nets to any
block drop out quick on $ext_if from any to $priv_nets

pass in on $int_if proto { tcp udp } from 192.168.0.1 to any queue up_host1
pass in on $int_if proto { tcp udp } from $host_usr8 to any queue up_host8
pass in on $int_if proto { tcp udp } from $host_usr9 to any queue up_host9
pass in on $int_if proto { tcp udp } from $host_usr10 to any queue up_host10
pass in on $int_if proto { tcp udp } from $host_usr11 to any queue up_host11
pass in on $int_if proto { tcp udp } from $host_usr12 to any queue up_host12
pass in on $int_if proto { tcp udp } from $host_usr13 to any queue up_host13
pass in on $int_if proto { tcp udp } from $host_usr14 to any queue up_host14
pass in on $int_if proto { tcp udp } from $host_usr15 to any queue up_host15
pass in on $int_if proto { tcp udp } from $host_usr16 to any queue up_host16

pass in on $ext_if inet proto tcp from any to ($ext_if) port $tcp_services flags S/SA keep state
pass in on $ext_if inet proto udp from any to ($ext_if) port $udp_service keep state
pass in inet proto icmp all icmp-type $icmp_types keep state
pass in on $int_if from $int_if:network to any

pass out on $int_if proto { tcp udp } from any to 192.168.0.1 queue dn_host1
pass out on $int_if proto { tcp udp } from any to $host_usr8 queue dn_host8
pass out on $int_if proto { tcp udp } from any to $host_usr9 queue dn_host9
pass out on $int_if proto { tcp udp } from any to $host_usr10 queue dn_host10
pass out on $int_if proto { tcp udp } from any to $host_usr11 queue dn_host11
pass out on $int_if proto { tcp udp } from any to $host_usr12 queue dn_host12
pass out on $int_if proto { tcp udp } from any to $host_usr13 queue dn_host13
pass out on $int_if proto { tcp udp } from any to $host_usr14 queue dn_host14
pass out on $int_if proto { tcp udp } from any to $host_usr15 queue dn_host15
pass out on $int_if proto { tcp udp } from any to $host_usr16 queue dn_host16

pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto { udp, icmp } all keep state
pass out on $int_if from any to $int_if:network

###Deny spoofing
antispoof for $ext_if
antispoof for $int_if

-----------------------------end
I would give 10% of band to each host and let everyone to borrow band for each other.
Is the conf correct?
Thanks so much,
mb.

Thanks for the fast answer s2scott.
Then, in my conf, are these lines correct:
---pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto { udp, icmp } all keep state
---
???
I'm asking another time with more precision about these two rules because I've a doubt about need to queue them or not. As you can see, they are not queued...is this correct so?

Another question:
I'm thinking about the code you've let me to know and I've understod why I may add it in my firewall, but I don't understand why I've to queue the rule also at "up_host1" and not only to "up_higest" and I don't understand why it isn't needed also a "dn_higest"...
sorry if my questions can seem "stupid" for you; I've never used a pf altq.

The last question:
"192.168.0.1" is my gateway/router/firewall/server (where OpenBSD runs), where I'm configuring pf...how much band it need if it have "only" to work as apache/vsftpd/cucipop/bind/internalVoipSystem server? 10% is correct or can I reduce the band dedicated to it?